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Abstract 

Many studies of mishaps show that human error is a factor in a significant majority of accidents. Trying to decide 
how to change human behavior to be safer is generally the biggest challenge of any safety program. Flowever, 
understanding the human psyche is the first step to changing behavior. Many studies focus on the before and after 
of an accident, but what about the thoughts of a person in the commission of an unsafe act? This is a less 
understood area. Examining it reveals why it is not well comprehended. This paper attempts to examine a part of 
the thought process, with an eye to helping influence people to less hurtful actions. 

Introduction 


This paper had its humble origins in a simple question, why do people deliberately do unsafe things? This thought 
process was set into motion by reading of the Tenerife Island aviation disaster (ref. 1). In 1977 a collision between 
two Boeing 747 craft caused what is still the deadliest aviation accident. The pilot of KLM Flight 4805 began take 
off without tower clearance in heavy fog on the airport’s only runway, crashing into the other Boeing 747 which was 
back taxiing on the runway. Ironically the pilot of KLM Flight 4805 had just returned from teaching a six month 
safety class for pilots. Why would a pilot so well trained and known for his safety record throw all that experience 
and knowledge away in a moment, leading to the death of 583 people? There are straightforward answers such as 
schedule pressures, cost, and so forth. However, it seemed that there must be something more. The pilot, in all 
likelihood, considered the opposite side of the equation. Certainly he had been under pressure in the past and had 
not made a disastrously unsafe choice before. Again, he was well known for his safety record. A simple answer 
seemed too simple. 


Background 


The initial research for this topic was informal, and truly, only for the author’s curiosity. A wide variety of people, 
but not a scientific sampling, was asked, “Have you ever done something that you knew in advance was unsafe. 
Why did you do it?” 

The responses fell into one of the following: 

In a hurry (schedule) 

Weary of looking for the right tool (apathy) 

Lack of or failure to locate the right equipment (apathy, complacency) 

Desire to finish quickly in order to return to pleasurable activity (lack of clarity of priorities) 

Had gotten away with it before (complacency, routine, “happens to others”) 

Showing off (pride) 

Failure to read directions (schedule, apathy, complacency) 

Short cutting safety concerns was easier (apathy, schedule) 

Tiredness (lack of clarity of priorities) 

Nervousness (lack of clarity of priorities) 

Distractedness (lack of clarity of priorities, complacency) 

Stubbornness (lack of clarity of priorities, pride) 

Unwillingness to admit a mistake, allowing accident to happen (pride) 

Failure to accept what one observes (pride) 

Miscommunication 

Lack of clarity in instructions 



As the list of people asked increased, the answers began to repeat. Also, interestingly enough, no one polled 
reported that they had never deliberately committed an unsafe act. This short list could, for the most part, be 
reduced to the two main problems which were mentioned in the opening paragraph, inattention and complacency. 


Discussion 


Why are people so careless and complacent when their own safety is at stake? Others may be at risk as well, but the 
most interesting question is why people are so casual with their own safety. This is not entirely a safety question but 
also a psychology question, by trying to decipher the thought process as someone bypasses a safety procedure when 
the consequences can be dire. A review of literature shows that most articles written on the psychology of safety 
deal with how to persuade employees to participate in a safety program. Also there are many articles written 
concerning the consequences of an unsafe act. What about the actions and thoughts immediately before and during 
the commission of an unsafe act? 

The ultimate answer may never be known for the Tenerife Island incident since the pilot didn’t survive to answer 
questions. However, other human-caused incidents are available for study. The space shuttle Challenger episode 
has been widely written about and analyzed by experts and laymen. This is a classic example of the combination of 
many aspects, all of which were due to the human factor. Humans made the decision to waiver the O-ring blow-by, 
realizing it was a risk. Humans made the decisions on how high to elevate the issue, or not. Humans made the 
decision to launch even though there were significant dissenting opinions about the safety of launching in degraded 
conditions. It was not the weather which caused the explosion; it was the decisions made by people in the decision 
loop. 

Having made that point, it is instructive to consider the point in time of the accident. The explosion was not simply 
due to blow-by of exhaust past the O-ring. Blow-by had occurred on a number of flights with no catastrophic 
failure. It happened when the exhaust escaping the SRB was directed at the External Tank, cutting through its 
aluminum skin. If the blow-by on STS-51-L had been located differently, another flight would have slipped by 
safely and no design change would have been made at that point. One is left to speculate how much longer this 
could have continued to happen before the inevitable failure did happen. However, the real point is that human 
decisions contributed to this accident, whenever it could have taken place. Decisions to continue to waiver the issue 
and fly because of complacency, due to getting away with it were the root causes. 

A factor brought out in recollections by persons involved in the many meetings surrounding the launch decision is 
peer pressure. This factor was chosen for emphasis because it has been largely overlooked in the voluminous 
writings on the subject. To be clear, the type of peer pressure focused on here is not the browbeating to which some 
engineers were subjected to cause them to go along with the choices already made by other persons involved in the 
launch decision process. This has already been well covered by other authors. In a recently written white paper 
(ref. 3), Arnold Aldrich, former program director for the National Space Transportation System (NSTS), 
demonstrates one instance in which a different type peer pressure affected parties involved in the launch decision. 
Aldrich had called a meeting of senior representatives of each space shuttle project to discuss the issue of ice on the 
launch complex. Two representatives of Rockwell International Orbiter Project provided the only dissenting 
opinions and stated that while they did not disagree with KSC and JSC calculations concerning low likelihood of ice 
impact to the orbiter, they did point out that this condition constituted additional risk for impacts to the shuttle 
orbiter, potentially affecting the success and safety of the launch attempt. Aldrich pressed them for a go/no go 
launch recommendation, but as the meeting continued and other engineers justified their go-for-launch decision, the 
two Rockwell International representatives began to back off on the amount of additional risk which they felt was 
being added, and, in fact, would not offer a firm recommendation on launch. It is of significant interest and 
consequence that such an important safety decision can be affected by peer pressure. 

Perhaps the Rockwell personnel felt that their engineering judgment was not correct in the force of a greater number 
of contrary opinions. Or perhaps they feared the consequences if the slim minority continued to press against the 
majority opinion. After all, if they caused a launch to be delayed for no good reason, what effect could that have on 
their reputations or careers? Also, they were not in a position to be able to prove later that their judgment had 
prevented a catastrophic failure. However, if a safety concern has any legitimacy then it should be brought forward 
and considered carefully rather than being pushed down by “launch fever” or any other drive that advances 



decisions. The psychological nature of peer pressure makes it a part of the human element pushing important 
decisions which can lead to disaster. The obvious question begged is what is to be done? 


Another case of significance, which demonstrates the element of human psychology in decision making, is the High 
Energy Solar Spectroscopic Imager (HESSI) (ref. 4). The satellite was placed on a shaker for vibration testing. The 
slip table on the shaker attaches to a granite slab, which is mounted to the floor. During testing, a slim layer of oil is 
pumped between the slip table and the granite slab such that the slip table is able to move freely while the vibration 
test is conducted. The testing parameters are controlled by a computer which directs the g level vibration. The 
HESSI was vibrated at 10 times the level appropriate to this test and as a result suffered structural damage. Post test 
examination of the vibration table showed that the shaker had shifted in its mounting base because a bearing support 
had failed. The damaged bearing caused misalignment between the slip table and granite slab causing friction, 
attenuating the motion of the test article. The test engineer interpreted this to mean a larger force was needed for the 
necessary acceleration. Enough force was applied to overcome the friction, but this led to the excessive vibration 
which damaged the satellite. Though the investigating board placed the root causes of the incidence in lack of 
requirements in maintenance and pre-test performance, the certainty of the test engineer in his evaluation of the data 
is also a factor which no one considered. Because there was not a scheduled maintenance program or periodic 
inspection of the shake table, the age (40 years) of the equipment should have caused question of its function for any 
test. The complacency of the test engineer and false confidence in aged and uninspected equipment caused him to 
place too much assurance in the data he received. Certainly mechanical breakdown is the primary problem. 
However, more caution on the human side still could have abated the incident. One wonders why it is requisite to 
inform an engineer to check out aged equipment before use. Also bearing on the human factor is the test engineer’s 
interpretation of the increased friction. He was overly confident in his supposed understanding of the equipment 
operation, without pausing the test to check for malfunction. This repeats the complacency and “getting away with 
it” attitude mentioned previously. 

A different satellite was inserted into wrong orbit due to neglect on the part of an engineer who made the choice not 
to validate requisite data (ref. 5). While launch preparations were underway, launch personnel prepared to make 
final measurements on the satellite’s inertial measurement unit (IMU). These readings were to be used along with 
factory calibration to adjust the satellite’s orientation during launch vehicle ascent. The IMU measurements were 
not able to be verified in a test bed because they had to be taken just before launch due to the design of the system. 
This situation left much margin for human error. To try to avert this difficulty, one person was intended to 
transcribe the calibration numbers from the factory print out and another would verify the numbers. However, the 
engineer overseeing this operation had copied the calibration data from factory computer print out onto a piece of 
paper and left the print out in his office. This engineer chose not to return to his office for the original data and 
when questioned by the operations people, insisted the copied data was sufficient. The numbers were typed in and 
verified. However, the engineer who had copied the numbers had omitted a character. Due to incorrect IMU data, 
the satellite was not inserted into the correct orbit. 

These three examples cover the spread between a person pressured into taking no action and a person who makes the 
conscious choice to take no action, even though the action was simple and straightforward. The reaction of the 
Rockwell personnel may be easier to understand. The simple act of returning to an office to retrieve a print out is 
more puzzling. Clearly each case must be studied in context. This paper will attempt to mine various areas of the 
spectrum to comprehend human thought at the moment of action or inaction. 

Considering the Challenger issue, the possibility has already been advanced that the engineers feared the 
consequences of their actions. This is a significant obstacle to overcome on any safety issue. If the consequences of 
a decision can be as great as the launch decision for Challenger, one cannot always assume that people with 
dissenting opinions will speak up, particularly if in the minority. Standing up for a no-go choice on that day would 
have saved lives. However, dire as the situation may have looked, could anyone have known with certainty that 
saying “no” would have made a difference? The shuttle is seen as a vehicle with safety margin and redundant 
systems built in. Also it had launched safely twenty-four times, even with the blow-by problem on the O-rings. 
That sort of false confidence has the potential to quiet people who may have doubts about their decisions. Even if 
they begin with no doubts, the number of people who line up against the dissenter may cause doubts to begin, or fear 
of retribution. Of course this reaches across the entire launch decision process, not just the meeting referenced. 
NASA has its safety reporting system which provides an anonymous way to report safety issues. However, there is 
no real time method of avoiding the direct confrontation which may drive some engineers into passive inaction. 



Confrontational discussions can be intimidating, particularly if emotions run high. Whether the intimidation is 
intended or not, it can and does occur. This is part of the psychological nature of safety decisions. The deliverer of 
daunting words and the receiver both are dealing with not just words and their direct meaning, but also tone of 
delivery, gestures, emphasis, and other things added to the bare meaning, such as profanity, personal attacks, 
questioning of understanding, among other things. To repeat, such attacks may not be intended to harass, question 
or threaten, but an aggressive delivery overrides intent, particularly if the deliverer is not known to the receiver. 
This is another facet of the psychological factor. People who work together and become used to personalities and 
temperaments may be able to decide when a debater is simply passionate about his position, but such discussions do 
not always occur between people who are acquainted. In that case, the person on the receiving end of a blistering 
denouncement is left for himself to attempt to interpret intent behind the words and actions. Add to that the nature 
of the day that each person has had, for example, and the pressures each may be under due to management, other 
work pressures or personal issues. What could be a simple give and take discussion under other circumstances can 
turn into an overheated fight on a different day. Imperfect and emotional humans are often in charge of sensitive 
and potentially danger-inducing decisions every day. 


It is possible that risk taking has become inherent to humans. When men had to choose to go out and face danger 
and potential death in order to provide food, the choice to take risk became easier since it was a matter of survival. 
Perhaps that became such a part of human nature that when the natural risk was gone, man had developed a drive 
inside to face danger with a less than completely safe attitude. This could explain the desire to engage in thrill rides, 
extreme sports, exploration in general, or in taking a certain amount of risk in all decision making, including safety 
decisions. Facing a risk and overcoming it provides instant gratification, something our fast-paced society has 
instilled in us as well. Brain chemistry also has a role in how an individual faces risk and resolves the conflict 
between safety and pleasure (ref. 6). Brain chemistry differs from individual to individual, so therefore, ability to 
face or accept risk will differ also; hence the tendency to heavy, intense discussions over safety issues. 

In his bestselling book, “Blink,” (ref. 7) Malcolm Gladwell discusses a phenomenon which he has labeled “mind 
blindness.” When the human brain becomes extremely stressed, it begins to shut down the array and quantity of 
data that it must sort through. Gladwell addresses both ends of the spectrum in his book. In the most extreme 
situation, a policeman firing on an alleged criminal, the officer says that he didn’t hear his own gun fire. His vision 
tunneled down so that he recalled seeing nothing except the head of the man on whom he was firing. In a less 
extreme case, Gladwell mentions statements made by basketball star Larry Bird who said that at critical moments in 
a game he heard nothing and the movements of other players seemed to slow. Clearly in moments of stress, the 
mind makes adjustments to allow focus on what is considered most important at the moment. Could this explain the 
actions of the pilot on Tenerife Island? Certainly he had been in pressured situations before. On the day of the 
accident, however, the layers of stress built to a great level as time seemed to be running out for the pilot to decide 
on a course of action, as inferred from those who have attempted to reconstruct and understand the pilot’s actions 
(ref 2). 

Gladwell references (ref. 7) “On Killing,” written by former army lieutenant Dan Grossman. According to 
Grossman, stress can enhance performance in the heart rate range of 115 - 145, which is the factor that Grossman 
chooses as a measure of stress. In this range, the mind does begin to sharpen focus and the stress is helpful in 
concentrating efforts to process data more efficiently. This is probably an inherent characteristic due to survival 
instincts already discussed (ref. 6). However, above 145 beats per minute, complex motor skills begin to give way 
and simple manual tasks become difficult. At 175 beats per minute cognitive processes completely break down. 
Time of exposure to the level of stress is an additional factor. Even if the stress is extreme, if the time of exposure is 
very brief, then the level of breakdown is not as severe; the level of pressure that essentially destroys cognitive 
processes will not reach such devastating degree because it doesn’t happen instantaneously. The cognitive system 
requires time to begin its response and if the time is short, the overload will not occur. 

It’s perhaps unlikely that the airline pilot experienced such an extreme level of stress. His plane sat at the end of a 
foggy runway, with visibility going in and out of limitations for the airport. He was very quickly approaching a time 
limit after which he would have to take a mandatory eight hour rest period, the neglect of which was not just a 
breach of the airliner’s rules, but a federal offense in his country. Taking the rest period would strand his plane-load 
of passengers on a tiny island whose only air field was overrun with diverted planes, with not enough hotel space for 



more than a couple planes’ worth of passengers. How much larger did these obstacles become to the man who had 
been named the Netherland’s safest pilot? Was he driven into the range of pressure where his mind began to shut 
off sources of information, so that his decision was not made with all factors properly considered? The answer is 
unobtainable, but this scenario certainly must be considered in order to avoid, whenever possible, pressing a person 
into making a safety decision while in such an advanced state of strain. 

However, time and circumstances do not always allow for a person to sit back to consider all options. The best that 
can be done is to allow as much time and information as the situation presents. Passing beyond a person’s ability to 
make proper decisions is something that is not always preventable. The human factor cannot be removed from any 
safety program. However, all programs and decisions should consider how much to diminish dependence on human 
judgment as much as reasonably possible. However, this poses its own problems. How much control should be 
given to humans and how much to machines? 

This decision was faced by the operators of the Maeslantkering storm surge barrier in the Netherlands (refs. 8 and 
9). The barrier is intended to stop flooding when storm surges strike the coast. The barrier is controlled by a 
computerized system which receives weather and sea level data. In usual weather conditions, the doors of the 
barrier are dry-docked with a 360 meter gap in the waterway to allow plenty of room for water-borne traffic to pass 
without hindrance or obstacle. If a storm surge of 3 meters above normal sea level is anticipated in Rotterdam, the 
computer, relying on its received data and predictions, will close the barrier doors to hold out the storm surge. Early 
in the operation of the barrier, a prediction was made for a storm surge of 3 meters. The computer began closure 
procedure for the barrier doors. As the storm was still in progress, however, the predictions lowered the estimated 
surge to 2.99 meters and the computer cancelled the alert and the closure. There were anxious moments for the 
operators as they considered the small difference in the prediction and discussed the potential of overriding the 
computer and closing the doors after all. In the end, the decision was left in the venue of the computer, the storm 
diminished and the surge was significantly less than the initial prediction. The waterway stayed open under the 
computer’s decision. Have we reached a point in computer development where more and more safety decisions can 
reliably be left to them? Likely not, but is that day even in view? 

Safety professional Pat Clemens says that a human operator should be used when a component is required which can 
think on its feet, processing information in ways, the need of which could not have been appreciated prior to the 
moment of need, and that can then act effectively using the result (ref. 10). 

As for humans, training and drilling is the best way to induce good safety decisions. Ample correct information is 
necessary but not sufficient. Because of the previously noted tendency of the brain to begin to shut down under 
stress, training is necessary to overcome the shut down. The simple act of phoning 911 in an emergency has proven 
to be beyond some people who have become too upset to perform the motor function (ref. 7). Drilling helps instill 
such reactions in the conscious part of the mind where it is easier for a stressed person to access the information and 
act rather than become addled. Stress has been demonstrated to be the largest contributor to human error. Drilling 
is one way to attempt to work around this. Drilling also assists in preventing error of commission; that is, taking the 
correct steps but in the wrong order, as well as preventing error of omission, leaving out steps. Lastly, drilling helps 
to prevent faulty processing of information or faulty analysis due to pressured circumstances (ref. 10). 

Lufthansa performed a study (ref. 11) of flight teams and discovered that social interaction difficulties within a team 
increased the number of critical incidents by a factor of five. The airline company has instituted a requisite program 
for pilots, which includes a two day seminar addressing human relationships and interactions. By establishing social 
intelligence and interpersonal competence, Lufthansa has found that 80% of human errors in complex situations can 
be prevented if there is proper social interaction among the flight team members. Additionally, Lufthansa found that 
giving the pilot absolute authority increases critical incidents. Other flight crew members are hesitant to speak up if 
a pilot error is observed. Specifically authorizing the entire flight crew to have input, and to point out mistakes, 
reduces incidents. The pilot is left with ultimate authority, as is appropriate, but crew members no longer have to 
fear repercussions if one articulates misgivings or indicates potential error in choice. 

The most devastating accidents are not always the ones in which a person is under severe stress to decide or to act. 
On 23 March 1994 Aeroflot Flight 593 crashed into a hillside in Kemerovo Oblast, with everyone onboard killed. 
The flight data recorders indicated that the pilot’s 15 year old son was seated at the airliner controls (ref. 12). 



Unknowingly he disabled the autopilot. The airliner rolled into a steep bank and entered a dive from which the 
pilots were unable to recover. 

The HESSI incident demonstrates the high level of trust that people sometimes place in equipment or in their 
judgment. The Challenger incident may be an indicator of how much trust people place in other people. Some 
people who didn’t speak or act may not have been oppressed into inaction, but may simply have trusted the persons 
or the process to drive out the correct answer. Trust is the other side of the complacency coin. Complacency seems 
a more passive state, whereas trust is active. Complacency implies not caring; trust implies much caring. Trust is a 
more positive state of mind than the list of responses given in the background section. However, trust is as affected 
by psychology as these other responses. When an engineer retreats from an argument due to trust, this is not to his 
discredit. Experts are called in for consultation because of their reputation. Still they are human and fallible. When 
an expert offers opinion, it can be expected that a percent of dissenters will retreat because of the perceived higher 
quality opinion offered. Can an expert be wrong? Certainly. Will another have confidence in his own thoughts, 
analysis and opinion to speak up? This depends on the psychology of the dissenter and of the situation. 

A noteworthy challenge in the psychology of safety is the sheer size and cost of projects in the aeronautics and 
aerospace industry. With such huge potential consequences at stake, one cannot always rely on a person to speak up 
on a safety issue. If indicating a potential risk may scrub a launch, likely the engineer will weigh his dissention 
against the cost of scrubbing and coming back another day to attempt to launch. How significant must the risk be to 
cause a single person to stand in the face of potential criticism and recommend a pause to consider the hazard? This 
is another facet of the Challenger decision. Multiple people did stand up to stop the launch. However, what if the 
voice is a single one? If the intimidation factor pressed down multiple voices that day, this is not an encouragement 
for one person to resist. 

What is to be done? 

The psychological approach to safety has a wide spectrum to span, from intense stress to complacency. Humans are 
fallible. Humans are given to emotions and reactions to stress. Humans are not predictable. Automating some 
decisions will help improve results. However, automation is not the answer to the dilemma either. Not all decisions 
can be made blindly by a computer. A computer is not infallible either, not only because it doesn’t always have the 
right or enough information, but also because they are programmed by fallible humans. There is no single answer to 
the safety dilemma, as is demonstrated by the years of research, practice and number of accidents to investigate and 
learn from. There is no single answer to the psychology of safety issue either. It is an area which deserves more 
study and understanding. Helping humans to comprehend why they react as they do could be one avenue to 
potential improvement. Improving training and interaction certainly would develop enhanced decisions. This is the 
best that can be hoped for, to make the best decisions that can be made. Helping engineers and managers understand 
more clearly the psychological impacts of confrontations, dissention, false confidence, true confidence, and so on, 
might enhance the process. 
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